Laboratory Services Cooperative

Summary

Laboratory Services Cooperative identified unauthorized network activity and a forensic investigation determined that a hacker accessed its systems and exfiltrated data containing names, dates of birth, contact details, medical records, claims information, billing data, health insurance information, Social Security numbers and other government identifiers. Notification of affected individuals began after the breach was discovered and the U.S. Department of Health and Human Services Office for Civil Rights was informed. Several class action lawsuits were filed alleging inadequate security practices and delayed notices, which were consolidated and later settled for six million one hundred thousand dollars. The settlement fund will cover attorneys’ fees, administration costs, service awards and provide class members with reimbursement for documented losses, pro rata cash payments and two years of credit and medical monitoring. The organization has since implemented security enhancements to reduce future risk.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On October 27, 2024, Laboratory Services Cooperative identified unauthorized network activity on its systems, prompting a forensic investigation that determined a hacker had gained access and removed data. The investigation revealed that the compromised information included names, dates of birth, contact details, medical information, claims information, billing information, health insurance information, Social Security numbers, and other government‑ or state‑issued identifiers. The organization did not disclose in its notification letters how long the intruders had maintained access to the network. Affected individuals began to receive breach notifications on or around April 10, 2025. The U.S. Department of Health and Human Services Office for Civil Rights was notified of the incident on November 20, 2024, and the OCR breach portal continues to list the breach as affecting 501 individuals.

In response to the breach, multiple class action lawsuits were filed and subsequently consolidated into In re Laboratory Services Cooperative Data Breach Litigation, which is pending in the U.S. District Court for the Western District of Washington. The plaintiffs allege that the breach resulted from inadequate data security systems, a failure to follow industry‑standard cybersecurity practices, delayed breach notifications, and notices that omitted important information about the incident. Their claims include negligence, breach of contract, unjust enrichment, invasion of privacy, and requests for declaratory and injunctive relief. Laboratory Services Cooperative disputes the allegations of wrongdoing, fault, and liability. To avoid the costs, delays, distractions, and risks of trial and appeals, the parties agreed to a settlement establishing a $6,100,000 fund. From this fund, costs and expenses will be deducted, including attorneys’ fees up to one‑third of the fund, notice and settlement administration costs, and service awards of up to $2,500 for class representatives. Class members may submit claims for reimbursement of documented, unreimbursed losses capped at $5,000 per member, receive a pro rata cash payment of up to $1,000 per member (which may be lower depending on the number of claims), and obtain two years of credit and medical information monitoring services. The deadline for objections and exclusions is October 26, 2026, the claim filing deadline is November 24, 2026, and the final fairness hearing is scheduled for January 4, 2027.

Laboratory Services Cooperative has stated that it made changes to its business practices and implemented security enhancements to reduce the risk of similar incidents in the future. The settlement fund, claim procedures, and associated deadlines constitute the resolved aspects of the litigation as described in the available source material. No further details about the specific nature of the security enhancements or the exact timeline of the attacker’s access are provided in the source evidence.

Sources

Sources available to members: 1 source.